2. Getting Consensus on the Conceptual Architecture

<h2>Concensus on the Conceptual Architecture</h2>

Getting consensus agreement to the conceptual security architecture is a major milestone in the programme. You will have collected all your information on the business requirements, analysed it and presented it in the form of the contextual security architecture. Now you synthesise a conceptual view of what the solutions will look like – the conceptual security architecture.

One of the reasons for a clear phase defi nition between the Strategy and Concept and Design phases of the SABSA® Lifecycle (see Chapter 7, Figure 7-2) is that this is a point at which you must obtain sign-off from the technical management community before you proceed to more detailed design work. You cannot proceed beyond this point without the support and buy-in of this group.

The way to tackle this is to build strong relationships with these people as early as possible. You may already have such relationships in place, but even if you do, you need to prepare the ground for this sign-off phase. A series of meetings with the key players will enable you to collect technical information or at least fi nd out where the detailed authoritative sources are to be found.

Far more important, these meetings will allow you to engage these individuals as early as possible on the subject of security architecture. You can fi nd out their general approach and opinions:

<ul>

<li>Do they have any concerns?</li>

<li>Are they pre-disposed for or against any particular approaches?</li>

<li>What will you need to do to get their agreement to the conceptual security architecture?</li>

<li>What level of influence do they expect to have?</li>

<li>What type of involvement in the process do they expect? </li>

<li>Who are their key allies and opponents? </li>

<li>What specific ‘buttons’ do they have that you will need to ‘push’?</li>

</ul>

When you get to the point of synthesising the conceptual architecture, you will need to involve this group actively. The best way is to arrange workshop sessions where you can present the ideas that you have, expose them to open debate, get all the inputs from all perspectives – systems development, procurement, operations management, etc. – and then hopefully through those discussions reach a consensus. Without such consensus the security architecture is likely to remain a paper exercise.

Pre-workshop preparation is also critical. It is dangerous to go to any open forum of the type just described without a clear idea of what all the players in the room think beforehand. So, you need to pre-sell your ideas. Make sure that you continue to leverage strong relationships with each person individually. Have one-to-one meetings to expose your ideas and get input. Work offline to overcome objections and difficulties and present new versions, until you are fairly confident that when you get them all in the same room for the workshop, the discussion is a mere
formality.